Haider Mustafa | SOC Analyst Portfolio
SOC investigations, detections, SIEM work, and applied AI.
I investigate suspicious authentication, troubleshoot systems and workflows, work through host and network evidence, write detections, and build AI systems with clear operational use cases.
Selected Projects
Security investigations, troubleshooting, and applied AI.
Featured Investigation
TrickBot network and memory forensics
Recovered a malicious DLL from network traffic, analysed memory artefacts, mapped likely infrastructure, and tied the activity back to the host and user involved.
SOC Investigation
Authentication abuse to PowerShell execution
Windows authentication abuse followed by hidden PowerShell, outbound traffic, and scheduled task persistence, with the findings written into an analyst report and detection pack.
Technical Operations
Windows endpoint setup and troubleshooting
A practical support lab covering workstation setup, device checks, troubleshooting, and resolution notes for common Windows issues.
Applied AI Build
Fine-tuning a compact model for phishing triage
Built and evaluated a LoRA fine-tuning pipeline for a compact phishing triage model that classifies suspicious messages and produces analyst-ready summaries.
Research Project
Concept drift in IoT intrusion detection
Security research on whether an IDS model stays reliable when network behaviour changes over time.
Network Simulation
Small office network simulation
Designed and validated a small office topology with DHCP, DNS, HTTP, and AAA services, then tested that the network behaved correctly end to end.
Packet Analysis
Wireshark packet analysis
Captured and inspected DNS and HTTP traffic to show what plaintext protocols expose and why encrypted transport matters in practice.
Key Skills
Key skills built through the work.
Evidence review, host attribution, and escalation decisions.
Working from artefacts and telemetry toward a defensible conclusion.
SPL searches, event correlation, detection writing, and alert tuning.
Using SIEM output to surface the highest-value events and move the investigation forward.
Failure diagnosis, root-cause review, and stable system recovery.
Working from symptoms, checks, and logs toward a reliable fix.
Clear reporting for technical and non-technical readers.
Short summaries first, deeper analysis when it is needed.
Technical Operations
Support-minded work across setup, troubleshooting, and handoff.
Alongside the security projects, this is the operational side of the work: preparing systems for use, isolating faults, documenting fixes clearly, and keeping environments usable.
Working from symptoms, checks, and logs toward a reliable fix.
Configuring devices, checking readiness, and making sure the machine is usable.
Clear handoff, direct updates, and support work that keeps things moving.
Writing the outcome clearly enough for the next person to pick it up fast.
Current Build Queue
Projects I am building next.
SOC alert to incident workflow simulation
Cloud misconfiguration detection lab
Phishing execution-chain review
Detection pack with tuning notes
Certifications
Certifications in progress.
CompTIA Security+
Covering core security operations, threats, controls, and incident-response fundamentals.
Splunk Core Certified User
Aligned to SPL searches, dashboards, field work, and practical SIEM workflows.
Microsoft SC-200
Focused on Sentinel investigation, KQL, incident handling, and security operations workflow.
Background
Supporting context.
University of Reading
Operating systems, networking, software systems design, AI, and security-focused final-year work.
Supporting experience
Four years of experience across customer-facing and operational roles, including device configuration, troubleshooting, and structured support in fast-moving environments.
Leadership
Leading teams, coordinating events, and handling stakeholders across large groups.
"What I appreciated most was his solution-oriented approach. When obstacles arose, Haider did not just point them out; he brought forward well-thought-out, scalable solutions that added value."
Recommendation from John Anning, Sales Team Lead at Home Made
Contact
Open to UK SOC analyst and security operations roles.
If you want someone who can investigate carefully, work across SIEM telemetry, and write clearly, send me a message.